Added an extra check to MLU bounds

Thanks to Ibrahim el-sayed for spotting the bug
mm2 · Aug 15, 2016 · 5ca71a7 · 5ca71a7 · yqxxbomb · Aug 15, 2016
1 parent 696d6b1
commit 5ca71a7
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/src/cmstypes.c b/src/cmstypes.c
@@ -1460,6 +1460,7 @@ void *Type_MLU_Read(struct _cms_typehandler_struct* self, cmsIOHANDLER* io, cmsU
 
         // Check for overflow
         if (Offset < (SizeOfHeader + 8)) goto Error;
+        if ((Offset + Len) > SizeOfTag + 8) goto Error;
 
         // True begin of the string
         BeginOfThisString = Offset - SizeOfHeader - 8;